Unauthenticated RCE in Dancer2 2.1.0 before 2.2.0 for Perl
CVSS 3.1
7.5high
EPSS
—
Published
()
Modified
AI analysis
Dancer2 versions from 2.1.0 before 2.2.0 contain a vulnerability in the File route handler that allows unauthenticated access to files outside public_dir via relative path segments. An attacker can use requests like /../outside.txt or percent-encoded dots to reach arbitrary files, including application config.yml. The flaw is enabled when the File route handler is named and static_handler is set to 0, and it can serve any file the worker process can read without authentication.
What to do: Upgrade to Dancer2 2.2.0 or later. Disable the File route handler or set static_handler to 0 to prevent serving files outside public_dir. Verify that no attacker-controlled path or request can reach config.yml or other files outside public_dir.
Affected
Dancer2 (Perl)
2.1.0 before 2.2.0
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file. The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs. Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.
Dancer2 before 2.2.0 can serve files outside public_dir via relative path segments.
oss-security carries CVE-2026-93712, affecting the Perl web framework Dancer2 from version 2.1.0 before 2.2.0. The File route handler can serve files from outside the configured public_dir when a request uses relative path segments. Stig Palmquist posted the notice, pointing to the MetaCPAN distribution and the PerlDancer GitHub repository. The announcement does not say the flaw is being exploited.